{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,18]],"date-time":"2026-03-18T17:46:54Z","timestamp":1773856014039,"version":"3.50.1"},"reference-count":34,"publisher":"Institute of Electronics, Information and Communications Engineers (IEICE)","issue":"10","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEICE Trans. Inf. & Syst."],"published-print":{"date-parts":[[2018,10,1]]},"DOI":"10.1587\/transinf.2018edp7073","type":"journal-article","created":{"date-parts":[[2018,9,30]],"date-time":"2018-09-30T22:09:56Z","timestamp":1538345396000},"page":"2485-2500","source":"Crossref","is-referenced-by-count":17,"title":["Advanced Ensemble Adversarial Example on Unknown Deep Neural Network Classifiers"],"prefix":"10.1587","volume":"E101.D","author":[{"given":"Hyun","family":"KWON","sequence":"first","affiliation":[{"name":"School of Computing, Korea Advanced Institute of Science and Technology"}]},{"given":"Yongchul","family":"KIM","sequence":"additional","affiliation":[{"name":"Department of Electrical Engineering, Korea Military Academy"}]},{"given":"Ki-Woong","family":"PARK","sequence":"additional","affiliation":[{"name":"Department of Computer and Information Security, Sejong University"}]},{"given":"Hyunsoo","family":"YOON","sequence":"additional","affiliation":[{"name":"School of Computing, Korea Advanced Institute of Science and Technology"}]},{"given":"Daeseon","family":"CHOI","sequence":"additional","affiliation":[{"name":"Department of Medical Information, Kongju National University"}]}],"member":"532","reference":[{"key":"1","doi-asserted-by":"publisher","unstructured":"[1] J. Schmidhuber, \u201cDeep learning in neural networks: An overview,\u201d Neural networks, vol.61, pp.85-117, 2015. 10.1016\/j.neunet.2014.09.003","DOI":"10.1016\/j.neunet.2014.09.003"},{"key":"2","unstructured":"[2] K. Simonyan and A. Zisserman, \u201cVery deep convolutional networks for large-scale image recognition,\u201d International Conference on Learning Representations, 2015."},{"key":"3","doi-asserted-by":"publisher","unstructured":"[3] G. Hinton, L. Deng, D. Yu, G.E. Dahl, A. Mohamed, N. Jaitly, A. Senior, V. Vanhoucke, P. Nguyen, T.N. Sainath, and B. Kingsbury, \u201cDeep neural networks for acoustic modeling in speech recognition: The shared views of four research groups,\u201d IEEE Signal Process. Mag., vol.29, no.6, pp.82-97, 2012. 10.1109\/msp.2012.2205597","DOI":"10.1109\/MSP.2012.2205597"},{"key":"4","unstructured":"[4] I. Arel, D.C. Rose, and R. Coop, \u201cDestin: A scalable deep learning architecture with application to high-dimensional robust pattern recognition,\u201d AAAI Fall Symposium: Biologically Inspired Cognitive Architectures, 2009."},{"key":"5","doi-asserted-by":"crossref","unstructured":"[5] G.L. Oliveira, A. Valada, C. Bollen, W. Burgard, and T. Brox, \u201cDeep learning for human part discovery in images,\u201d 2016 IEEE International Conference on Robotics and Automation (ICRA), pp.1634-1641, IEEE, 2016. 10.1109\/icra.2016.7487304","DOI":"10.1109\/ICRA.2016.7487304"},{"key":"6","doi-asserted-by":"crossref","unstructured":"[6] R. Collobert and J. Weston, \u201cA unified architecture for natural language processing: Deep neural networks with multitask learning,\u201d Proc. 25th international conference on Machine learning, pp.160-167, ACM, 2008. 10.1145\/1390156.1390177","DOI":"10.1145\/1390156.1390177"},{"key":"7","unstructured":"[7] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I.Goodfellow, and R. Fergus, \u201cIntriguing properties of neural networks,\u201d International Conference on Learning Representations, 2014."},{"key":"8","doi-asserted-by":"publisher","unstructured":"[8] F. Zhang, P.P.K. Chan, B. Biggio, D.S. Yeung, and F. Roli, \u201cAdversarial feature selection against evasion attacks,\u201d IEEE Trans. Cybern., vol.46, no.3, pp.766-777, 2016. 10.1109\/tcyb.2015.2415032","DOI":"10.1109\/TCYB.2015.2415032"},{"key":"9","doi-asserted-by":"crossref","unstructured":"[9] N. Carlini and D. Wagner, \u201cTowards evaluating the robustness of neural networks,\u201d 2017 IEEE Symposium on Security and Privacy (SP), pp.39-57, IEEE, 2017. 10.1109\/sp.2017.49","DOI":"10.1109\/SP.2017.49"},{"key":"10","doi-asserted-by":"crossref","unstructured":"[10] S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, \u201cDeepfool: a simple and accurate method to fool deep neural networks,\u201d Proc. IEEE Conference on Computer Vision and Pattern Recognition, pp.2574-2582, 2016. 10.1109\/cvpr.2016.282","DOI":"10.1109\/CVPR.2016.282"},{"key":"11","doi-asserted-by":"crossref","unstructured":"[11] N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami, \u201cDistillation as a defense to adversarial perturbations against deep neural networks,\u201d 2016 IEEE Symposium on Security and Privacy (SP), pp.582-597, IEEE, 2016. 10.1109\/sp.2016.41","DOI":"10.1109\/SP.2016.41"},{"key":"12","doi-asserted-by":"crossref","unstructured":"[12] D. Meng and H. Chen, \u201cMagnet: a two-pronged defense against adversarial examples,\u201d Proc. 2017 ACM SIGSAC Conference on Computer and Communications Security, pp.135-147, ACM, 2017. 10.1145\/3133956.3134057","DOI":"10.1145\/3133956.3134057"},{"key":"13","doi-asserted-by":"crossref","unstructured":"[13] N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z.B. Celik, and A. Swami, \u201cPractical black-box attacks against machine learning,\u201d Proc. 2017 ACM on Asia Conference on Computer and Communications Security, pp.506-519, ACM, 2017. 10.1145\/3052973.3053009","DOI":"10.1145\/3052973.3053009"},{"key":"14","unstructured":"[14] Y. LeCun, C. Cortes, and C.J.C. Burges, Mnist handwritten digit database, AT&T Labs [Online]. Available: http:\/\/yann.lecun.com\/exdb\/mnist, 2, 2010."},{"key":"15","unstructured":"[15] I. Goodfellow, J. Shlens, and C. Szegedy, \u201cExplaining and harnessing adversarial examples,\u201d International Conference on Learning Representations, 2015."},{"key":"16","unstructured":"[16] Y. Liu, X. Chen, C. Liu, and D. Song, \u201cDelving into transferable adversarial examples and black-box attacks,\u201d ICLR, abs\/1611.02770, 2017."},{"key":"17","unstructured":"[17] A. Krizhevsky, V. Nair, and G. Hinton, The cifar-10 dataset, online: http:\/\/www.cs.toronto.edu\/kriz\/cifar.html, 2014."},{"key":"18","doi-asserted-by":"crossref","unstructured":"[18] A. Kurakin, I. Goodfellow, and S. Bengio, \u201cAdversarial examples in the physical world,\u201d ICLR Workshop, 2017.","DOI":"10.1201\/9781351251389-8"},{"key":"19","unstructured":"[19] S.M.M. Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, \u201cUniversal adversarial perturbations,\u201d Proc. 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), number EPFL-CONF-226156, 2017."},{"key":"20","doi-asserted-by":"crossref","unstructured":"[20] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei,\u201cImagenet: A large-scale hierarchical image database,\u201d IEEE Conference on Computer Vision and Pattern Recognition, 2009, CVPR 2009, pp.248-255, IEEE, 2009. 10.1109\/cvprw.2009.5206848","DOI":"10.1109\/CVPRW.2009.5206848"},{"key":"21","unstructured":"[21] S. Baluja and I. Fischer, \u201cAdversarial transformation networks: Learning to generate adversarial examples,\u201d arXiv preprint arXiv:1703.09387, 2017."},{"key":"22","unstructured":"[22] M. Abadi, P. Barham, J. Chen, Z. Chen, A. Davis, J. Dean, M. Devin, S. Ghemawat, G. Irving, M. Isard, et al., \u201cTensorflow: A system for large-scale machine learning,\u201d OSDI, vol.16, pp.265-283, 2016."},{"key":"23","doi-asserted-by":"publisher","unstructured":"[23] Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner, \u201cGradient-based learning applied to document recognition,\u201d Proc. IEEE, vol.86, no.11, pp.2278-2324, 1998. 10.1109\/5.726791","DOI":"10.1109\/5.726791"},{"key":"24","unstructured":"[24] K. Simonyan and A. Zisserman, \u201cVery deep convolutional networks for large-scale image recognition,\u201d ICLR 2015, 2015."},{"key":"25","unstructured":"[25] D. Kingma and J. Ba, \u201cAdam: A method for stochastic optimization,\u201d The International Conference on Learning Representations (ICLR), 2015."},{"key":"26","unstructured":"[26] K. Sopyta, https:\/\/github.com\/ksopyla, Github."},{"key":"27","unstructured":"[27] D. Mishkin and J. Matas, \u201cAll you need is a good init,\u201d arXiv preprint arXiv:1511.06422, 2015."},{"key":"28","unstructured":"[28] I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio, \u201cGenerative adversarial nets,\u201dAdvances in Neural Information Processing Systems, pp.2672-2680, 2014."},{"key":"29","unstructured":"[29] N. Carlini, P. Mishra, T. Vaidya, Y. Zhang, M. Sherr, C. Shields, D. Wagner, and W. Zhou, \u201cHidden voice commands,\u201d USENIX Security Symposium, pp.513-530, 2016."},{"key":"30","doi-asserted-by":"crossref","unstructured":"[30] G. Zhang, C. Yan, X. Ji, T. Zhang, T. Zhang, and W. Xu,\u201cDolphinattack: Inaudible voice commands,\u201d Proc. 2017 ACM SIGSAC Conference on Computer and Communications Security, pp.103-117, ACM, 2017. 10.1145\/3133956.3134052","DOI":"10.1145\/3133956.3134052"},{"key":"31","doi-asserted-by":"publisher","unstructured":"[31] C. Kereliuk, B.L. Sturm, and J. Larsen, \u201cDeep learning and music adversaries,\u201d IEEE Trans. Multimedia, vol.17, no.11, pp.2059-2071, 2015. 10.1109\/tmm.2015.2478068","DOI":"10.1109\/TMM.2015.2478068"},{"key":"32","unstructured":"[32] A. Rozsa, M. G\u00fcnther, E.M. Rudd, and T.E. Boult, \u201cFacial attributes: Accuracy and adversarial robustness,\u201d Pattern Recognition Letters, 2017."},{"key":"33","doi-asserted-by":"publisher","unstructured":"[33] M. Osadchy, J. Hernandez-Castro, S. Gibson, O. Dunkelman, and D. P\u00e9rez-Cabo, \u201cNo bot expects the deepcaptcha! introducing immutable adversarial examples, with applications to captcha generation,\u201d IEEE Trans. Inf. Forensics Security, vol.12, no.11, pp.2640-2653, 2017. 10.1109\/tifs.2017.2718479","DOI":"10.1109\/TIFS.2017.2718479"},{"key":"34","doi-asserted-by":"publisher","unstructured":"[34] H. Kwon, Y. Kim, H. Yoon, and D. Choi, \u201cCaptcha image generation systems using generative adversarial networks,\u201d IEICE Trans. Inf. & Syst., vol.E101-D, no.2, pp.543-546, 2018. 10.1587\/transinf.2017edl8175","DOI":"10.1587\/transinf.2017EDL8175"}],"container-title":["IEICE Transactions on Information and Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.jstage.jst.go.jp\/article\/transinf\/E101.D\/10\/E101.D_2018EDP7073\/_pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,9,3]],"date-time":"2022-09-03T00:47:39Z","timestamp":1662166059000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.jstage.jst.go.jp\/article\/transinf\/E101.D\/10\/E101.D_2018EDP7073\/_article"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,10,1]]},"references-count":34,"journal-issue":{"issue":"10","published-print":{"date-parts":[[2018]]}},"URL":"https:\/\/doi.org\/10.1587\/transinf.2018edp7073","relation":{},"ISSN":["0916-8532","1745-1361"],"issn-type":[{"value":"0916-8532","type":"print"},{"value":"1745-1361","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018,10,1]]}}}